@bitkyc08/opencodex 2.14.1 → 2.14.2

package/src/providers/base-url-choices.ts

@@ -62,3 +62,13 @@ export function matchBaseUrlChoice(
   }
   return choices.some(c => c.id === "custom") ? "custom" : choices[0]!.id;
 }
+
+/** Moonshot/Kimi API endpoint presets (international default; China selectable). */
+export const MOONSHOT_INTL_BASE_URL = "https://api.moonshot.ai/v1";
+export const MOONSHOT_CN_BASE_URL = "https://api.moonshot.cn/v1";
+
+export const MOONSHOT_BASE_URL_CHOICES: readonly ProviderBaseUrlChoice[] = [
+  { id: "international", label: "International (.ai)", baseUrl: MOONSHOT_INTL_BASE_URL },
+  { id: "china", label: "China (.cn)", baseUrl: MOONSHOT_CN_BASE_URL },
+  { id: "custom", label: "Custom" },
+];

package/src/providers/command-code-efforts.ts

@@ -13,6 +13,24 @@ const COMMAND_CODE_MODEL_EFFORTS = {
     efforts: ["high", "max"],
     profileUrl: "https://commandcode.ai/models/glm-5-2",
   },
+  // Muse Spark: CLI currently prints "has no adjustable reasoning effort" and
+  // blocks --effort locally, but the upstream /alpha/generate endpoint accepts
+  // reasoning_effort low..max for meta/muse-spark-1.2-contributor (verified
+  // 2026-08-13: direct upstream POST with low/medium/high/xhigh/max all 200,
+  // ultra 400; reasoningTokens differentiated 114..253; proxy previously stripped
+  // the field so effort changes had no effect).
+  "meta/muse-spark-1.2": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.2",
+  },
+  "meta/muse-spark-1.2-contributor": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.2-contributor",
+  },
+  "meta/muse-spark-1.1": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.1",
+  },
 } as const;
 
 /**

package/src/providers/model-rename-migration.ts

@@ -0,0 +1,202 @@
+// Registry model renames do not reach a saved provider config on their own.
+//
+// `reconcileOAuthProviders` refuses to touch a row whose `authMode` is not
+// `oauth` (src/oauth/index.ts), and `enrichProviderFromRegistry` is fill-only by
+// design: it backfills a MISSING field and never rewrites a present one, so a
+// user's hand-edited model list survives an upgrade. Both postures are correct.
+// Their gap is the case where the registry did not ADD a model but RENAMED one:
+// the saved row keeps a retired id forever, the supported id never appears, and
+// the capability metadata stays keyed to an id the vendor is taking offline
+// (issue #1610 — `qwen3.8-max-preview` persisted through the `qwen3.8-max`
+// rename in six separate fields, including a reasoning ladder that had since
+// diverged from the registry's).
+//
+// This migration is deliberately NOT general reconciliation. It rewrites exactly
+// one thing: an id this file declares retired, on a provider that still carries
+// the registry's transport, and only when the registry currently seeds the
+// replacement. Everything else in the row is left alone.
+
+import { PROVIDER_REGISTRY } from "./registry";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+
+export interface ModelRename {
+  /** Registry provider id whose saved rows may carry the retired model id. */
+  provider: string;
+  from: string;
+  to: string;
+  /** Why the vendor retired it, for the startup warning and future readers. */
+  reason: string;
+}
+
+/**
+ * Renames already applied to `PROVIDER_REGISTRY`. An entry stays here after the
+ * registry moves on: it is what repairs configs saved before that move. Removing
+ * one strands every config that has not started since the rename shipped.
+ */
+export const MODEL_RENAMES: readonly ModelRename[] = [
+  {
+    provider: "alibaba-token-plan",
+    from: "qwen3.8-max-preview",
+    to: "qwen3.8-max",
+    reason: "Alibaba shipped Qwen3.8-Max as stable and documents the preview endpoint as liable to be taken offline once preview concludes",
+  },
+  {
+    provider: "alibaba-token-plan-intl",
+    from: "qwen3.8-max-preview",
+    to: "qwen3.8-max",
+    reason: "Alibaba shipped Qwen3.8-Max as stable and documents the preview endpoint as liable to be taken offline once preview concludes",
+  },
+];
+
+/** Provider fields that key metadata by model id. */
+const MODEL_KEYED_RECORDS = [
+  "modelContextWindows",
+  "modelMaxOutputTokens",
+  "modelInputModalities",
+  "modelReasoningEfforts",
+  "modelDefaultReasoningEfforts",
+  "modelReasoningEffortMap",
+] as const;
+
+/** Provider fields that are flat lists of model ids. */
+const MODEL_ID_LISTS = [
+  "models",
+  "noVisionModels",
+  "noReasoningModels",
+  "noTemperatureModels",
+  "noTopPModels",
+  "noPenaltyModels",
+  "autoToolChoiceOnlyModels",
+  "preserveReasoningContentModels",
+  "thinkingBudgetModels",
+  "directReasoningEffortModels",
+] as const;
+
+function renameInList(value: unknown, from: string, to: string): string[] | null {
+  if (!Array.isArray(value) || !value.includes(from)) return null;
+  const seen = new Set<string>();
+  const next: string[] = [];
+  // Rename in place to preserve ordering, and collapse a duplicate if the target
+  // id was already present alongside the retired one.
+  for (const entry of value) {
+    if (typeof entry !== "string") continue;
+    const mapped = entry === from ? to : entry;
+    if (seen.has(mapped)) continue;
+    seen.add(mapped);
+    next.push(mapped);
+  }
+  return next;
+}
+
+function renameInRecord(value: unknown, from: string, to: string): Record<string, unknown> | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record = value as Record<string, unknown>;
+  if (!(from in record)) return null;
+  const next: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(record)) {
+    const mapped = key === from ? to : key;
+    if (mapped in next) continue;
+    // An explicit entry already saved under the new id is the newer intent.
+    next[mapped] = key === from && to in record ? record[to] : entry;
+  }
+  return next;
+}
+
+/**
+ * `provider/model` rows in the top-level `disabledModels` list.
+ *
+ * The retired row is DROPPED rather than renamed: carrying its disabled state to
+ * the new id would hide the supported model behind a toggle the user set for a
+ * different model. An existing row for the new id is left untouched.
+ */
+function renameDisabledModels(config: OcxConfig, rename: ModelRename): boolean {
+  const list = config.disabledModels;
+  if (!Array.isArray(list)) return false;
+  const retired = `${rename.provider}/${rename.from}`;
+  if (!list.includes(retired)) return false;
+  config.disabledModels = list.filter(entry => entry !== retired);
+  return true;
+}
+
+/**
+ * Only migrate a row that still points at the registry's own endpoint. A user who
+ * repointed `baseUrl` at a different vendor owns their model ids.
+ */
+function providerStillMatchesRegistry(name: string, prov: OcxProviderConfig): boolean {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === name);
+  if (!entry) return false;
+  if (!prov.baseUrl || !entry.baseUrl) return true;
+  const choices = entry.baseUrlChoices?.map(choice => choice.baseUrl) ?? [];
+  const known = [entry.baseUrl, ...choices]
+    .filter((url): url is string => typeof url === "string")
+    .map(url => url.replace(/\/+$/, ""));
+  return known.includes(prov.baseUrl.replace(/\/+$/, ""));
+}
+
+/** Guard against a stale rename: only apply when the registry actually seeds `to`. */
+function registrySeedsTarget(rename: ModelRename): boolean {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === rename.provider);
+  return !!entry?.models?.includes(rename.to);
+}
+
+export interface ModelRenameProjection {
+  config: OcxConfig;
+  changed: boolean;
+  warnings: string[];
+}
+
+/**
+ * Pure projection: apply every applicable rename and report what changed. The
+ * caller decides whether to persist.
+ */
+export function projectModelRenames(
+  config: OcxConfig,
+  renames: readonly ModelRename[] = MODEL_RENAMES,
+): ModelRenameProjection {
+  const warnings: string[] = [];
+  let changed = false;
+
+  for (const rename of renames) {
+    const prov = config.providers?.[rename.provider];
+    if (!prov) continue;
+    if (!registrySeedsTarget(rename)) {
+      warnings.push(
+        `registry no longer seeds "${rename.to}" for "${rename.provider}"; skipping the `
+        + `"${rename.from}" rename rather than writing an id the registry does not know.`,
+      );
+      continue;
+    }
+    if (!providerStillMatchesRegistry(rename.provider, prov)) continue;
+
+    // Provider config is a closed interface, so index through one unknown-cast
+    // view rather than casting at each assignment.
+    const row = prov as unknown as Record<string, unknown>;
+    let touched = false;
+    for (const field of MODEL_ID_LISTS) {
+      const next = renameInList(row[field], rename.from, rename.to);
+      if (!next) continue;
+      row[field] = next;
+      touched = true;
+    }
+    for (const field of MODEL_KEYED_RECORDS) {
+      const next = renameInRecord(row[field], rename.from, rename.to);
+      if (!next) continue;
+      row[field] = next;
+      touched = true;
+    }
+    if (prov.defaultModel === rename.from) {
+      prov.defaultModel = rename.to;
+      touched = true;
+    }
+    if (renameDisabledModels(config, rename)) touched = true;
+
+    if (touched) {
+      changed = true;
+      warnings.push(
+        `renamed "${rename.provider}/${rename.from}" to "${rename.to}" in the saved config: ${rename.reason}.`,
+      );
+    }
+  }
+
+  return { config, changed, warnings };
+}

package/src/providers/model-rename-startup.ts

@@ -0,0 +1,28 @@
+import { saveConfig } from "../config";
+import { projectModelRenames } from "./model-rename-migration";
+import type { OcxConfig } from "../types";
+
+export interface ModelRenameStartupDeps {
+  project: typeof projectModelRenames;
+  save: (config: OcxConfig) => void;
+}
+
+/**
+ * Apply registry model renames to the saved config at startup (issue #1610).
+ *
+ * No backup is taken, unlike the OpenAI tier and Alibaba region migrations: those
+ * rewrite credentials and provider identity, where a bad projection is not
+ * recoverable from the config alone. This one only rewrites model ids that the
+ * registry itself no longer seeds, and the pre-migration value is a string this
+ * file still names, so the change is reversible by hand.
+ */
+export function runModelRenameStartupMigration(
+  config: OcxConfig,
+  deps: ModelRenameStartupDeps = { project: projectModelRenames, save: saveConfig },
+): OcxConfig {
+  const projection = deps.project(config);
+  for (const warning of projection.warnings) console.warn(`[model-rename-migration] ${warning}`);
+  if (!projection.changed) return projection.config;
+  deps.save(projection.config);
+  return projection.config;
+}

package/src/providers/openai-tier-startup.ts

@@ -1,4 +1,10 @@
-import { backupConfigBeforeOpenAiTierMigration, saveConfig } from "../config";
+import {
+  backupConfigBeforeOpenAiTierMigration,
+  OpenAiTierBackupCollisionError,
+  OpenAiTierRollbackPreserveError,
+  preserveOpenAiTierRollbackSnapshot,
+  saveConfig,
+} from "../config";
 import type { OcxConfig } from "../types";
 import { projectOpenAiTierMigration } from "./openai-tiers";
 
@@ -6,6 +12,23 @@ export interface OpenAiTierStartupDeps {
   project: typeof projectOpenAiTierMigration;
   backup: () => void;
   save: (config: OcxConfig) => void;
+  preserveRollback?: (error: OpenAiTierBackupCollisionError) => void;
+}
+
+function defaultPreserveRollback(error: OpenAiTierBackupCollisionError): void {
+  if (!error.configPath) throw error;
+  try {
+    const preserved = preserveOpenAiTierRollbackSnapshot(error.configPath);
+    console.warn(`[openai-provider-migration] Preserved rollback snapshot at ${preserved}`);
+  } catch (cause) {
+    if (
+      cause instanceof OpenAiTierRollbackPreserveError
+      && (cause.code === "missing" || cause.code === "not-rollback")
+    ) {
+      throw error;
+    }
+    throw cause;
+  }
 }
 
 const DEFAULT_DEPS: OpenAiTierStartupDeps = {
@@ -20,7 +43,13 @@ export function runOpenAiTierStartupMigration(
 ): OcxConfig {
   const projection = deps.project(config);
   if (!projection.changed) return projection.config;
-  deps.backup();
+  try {
+    deps.backup();
+  } catch (error) {
+    if (!(error instanceof OpenAiTierBackupCollisionError)) throw error;
+    (deps.preserveRollback ?? defaultPreserveRollback)(error);
+    deps.backup();
+  }
   deps.save(projection.config);
   for (const warning of projection.warnings) console.warn(`[openai-provider-migration] ${warning}`);
   return projection.config;

package/src/providers/quota.ts

@@ -783,9 +783,16 @@ async function fetchMoonshotQuota(provider: string, config: OcxProviderConfig):
   if (available === undefined || available < 0) return null;
   // Moonshot exposes no per-window quota ceiling, only a balance — report it
   // as a balance-only window (percent 0) rather than a fabricated utilization.
+  // Currency is host-scoped: China platform (api.moonshot.cn) bills in CNY;
+  // the international platform (api.moonshot.ai) bills in USD. Do not force
+  // either side into the other unit — the number is correct, only the unit
+  // must match the host.
+  const isChinaHost = host.startsWith("https://api.moonshot.cn");
+  const money = (n: number) => isChinaHost ? `¥${n.toFixed(2)}` : `$${n.toFixed(2)}`;
+  const unit = isChinaHost ? "CNY" : "USD";
   const label = voucher !== undefined && cash !== undefined
-    ? `Balance ($${available.toFixed(2)} available, $${voucher.toFixed(2)} voucher)`
-    : `Balance ($${available.toFixed(2)} available)`;
+    ? `Balance (${money(available)} ${unit} available, ${money(voucher)} voucher)`
+    : `Balance (${money(available)} ${unit} available)`;
   return report(provider, "moonshot:balance", {
     customWindows: [{ label, percent: 0 }],
     updatedAt: Date.now(),

package/src/providers/registry.ts

@@ -6,6 +6,7 @@ import {
   QWEN_CLOUD_BASE_URL_CHOICES, QWEN_CLOUD_TOKEN_PLAN_BASE_URL,
   ALIBABA_INTL_BASE_URL_CHOICES, ALIBABA_INTL_TOKEN_PLAN_BASE_URL,
   ALIBABA_CODING_BASE_URL_CHOICES, ALIBABA_CODING_INTL_BASE_URL,
+  MOONSHOT_BASE_URL_CHOICES, MOONSHOT_INTL_BASE_URL,
 } from "./base-url-choices";
 import {
   CURSOR_STATIC_MODELS,
@@ -950,8 +951,8 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // devlog/model_update/260709_model_refresh/001_xai_lineup.md.
     // grok-4.20-multi-agent-0309 is intentionally absent: the OAuth chat-completions
     // transport returns 400 ("Multi Agent requests are not allowed on chat completions").
-    // 260813: grok-4.6 added per the new docs.x.ai/developers/grok-4-6 page; specs mirrored
-    // from grok-4.5 until the official capability/pricing tables settle.
+    // 260813: grok-4.6 added per docs.x.ai/developers/grok-4-6. Context/vision still match
+    // grok-4.5; the reasoning ladder does not — 4.6 adds the documented xhigh rung.
     models: ["grok-4.6", "grok-4.5", "grok-4.3", "grok-4.20-0309-reasoning", "grok-4.20-0309-non-reasoning", "grok-build-0.1", "grok-composer-2.5-fast"],
     defaultModel: "grok-4.5",
     // Vision lineup per docs.x.ai model-capabilities/images/understanding: the grok-4.x chat
@@ -973,8 +974,11 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // (docs.x.ai prompt-caching/multi-turn, verified 2026-07-13 — devlog/_plan/260713_grok_caching).
     // Models that never emit reasoning simply have no thinking parts to replay (no-op).
     preserveReasoningContentModels: ["grok-4.6", "grok-4.5", "grok-4.3", "grok-4.20-0309-reasoning"],
-    // grok-4.5 reasoning is always-on with low/medium/high control (no off tier upstream).
-    modelReasoningEfforts: { "grok-4.6": ["low", "medium", "high"], "grok-4.5": ["low", "medium", "high"] },
+    // grok-4.5 reasoning is always-on with low/medium/high (no off tier, no xhigh).
+    // grok-4.6 adds xhigh per docs.x.ai/developers/model-capabilities/text/reasoning;
+    // xAI documents high as the upstream default.
+    modelReasoningEfforts: { "grok-4.6": ["low", "medium", "high", "xhigh"], "grok-4.5": ["low", "medium", "high"] },
+    modelDefaultReasoningEfforts: { "grok-4.6": "high" },
     modelContextWindows: {
       "grok-4.6": 500_000,
       "grok-4.5": 500_000,
@@ -1870,7 +1874,9 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     note: "Model data frozen pending Tier-2 entitlement proof",
   },
   {
-    id: "moonshot", label: "Moonshot (Kimi API)", baseUrl: "https://api.moonshot.ai/v1", adapter: "openai-chat", authKind: "key",
+    id: "moonshot", label: "Moonshot (Kimi API)", baseUrl: MOONSHOT_INTL_BASE_URL, adapter: "openai-chat", authKind: "key",
+    allowBaseUrlOverride: true,
+    baseUrlChoices: MOONSHOT_BASE_URL_CHOICES,
     dashboardUrl: "https://platform.moonshot.ai/console/api-keys", defaultModel: "kimi-k2.7-code", jawcodeBundle: "moonshot",
     models: KIMI_API_MODELS,
     modelContextWindows: KIMI_API_MODEL_CONTEXT_WINDOWS,
@@ -1882,6 +1888,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     noPenaltyModels: KIMI_API_MODELS,
     autoToolChoiceOnlyModels: ["kimi-k2.7-code", "kimi-k2.7-code-highspeed"],
     preserveReasoningContentModels: KIMI_API_MODELS,
+    note: "International default (api.moonshot.ai). China accounts: choose China (.cn) or Custom for api.moonshot.cn.",
   },
   { id: "huggingface", label: "Hugging Face", baseUrl: "https://router.huggingface.co/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://huggingface.co/settings/tokens" },
   // 260715 NIM hardening (issue #126, devlog/_plan/260715_issue126_nim_kimi):

package/src/responses/spill-store.ts

@@ -34,6 +34,7 @@ export interface ResponseSpillPayload {
   version: 1;
   responseId: string;
   createdAt: number;
+  clientThreadId?: string;
   items: unknown[];
   providers?: OcxProviderContinuationState;
 }
@@ -260,9 +261,11 @@ function validPayload(value: unknown, responseId: string): value is ResponseSpil
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const payload = value as Record<string, unknown>;
   const keys = Object.keys(payload);
-  if (keys.some(key => !["version", "responseId", "createdAt", "items", "providers"].includes(key))) return false;
+  if (keys.some(key => !["version", "responseId", "createdAt", "clientThreadId", "items", "providers"].includes(key))) return false;
   if (payload.version !== 1 || payload.responseId !== responseId) return false;
   if (typeof payload.createdAt !== "number" || !Number.isFinite(payload.createdAt)) return false;
+  if (payload.clientThreadId !== undefined
+    && (typeof payload.clientThreadId !== "string" || payload.clientThreadId.trim().length === 0)) return false;
   if (!Array.isArray(payload.items)) return false;
   if (payload.providers !== undefined) {
     if (!payload.providers || typeof payload.providers !== "object" || Array.isArray(payload.providers)) return false;
@@ -284,6 +287,7 @@ export function writeResponseSpillDurably(
       version: 1,
       responseId,
       createdAt: state.createdAt,
+      ...(state.clientThreadId ? { clientThreadId: state.clientThreadId } : {}),
       items: state.items,
       ...(state.providers ? { providers: state.providers } : {}),
     };

package/src/responses/state.ts

@@ -37,6 +37,7 @@ const MAX_SNAPSHOT_REWRITE_ATTEMPTS = 4;
 interface ResidentResponseState {
   kind: "resident";
   createdAt: number;
+  clientThreadId?: string;
   items: unknown[];
   providers?: OcxProviderContinuationState;
   sizeBytes: number;
@@ -45,6 +46,7 @@ interface ResidentResponseState {
 interface SpilledResponseState {
   kind: "spill";
   createdAt: number;
+  clientThreadId?: string;
   providers?: OcxProviderContinuationState;
   spill: ResponseSpillRef;
   sizeBytes: number;
@@ -65,6 +67,7 @@ export type PreviousResponseReplayFailure = {
 };
 
 const states = new Map<string, StoredResponseState>();
+const replayScopeMismatches = new WeakSet<object>();
 let storedResponseBytes = 0;
 let residentResponseBytes = 0;
 let oldestResidentId: string | undefined;
@@ -80,6 +83,7 @@ const spillCounters = { writes: 0, writeFailures: 0, readFailures: 0 };
  * snapshot files refused before parse.
  */
 const admissionCounters = { directSpills: 0, oversizedDrops: 0, snapshotOversizedRefusals: 0 };
+let replayScopeMismatchDrops = 0;
 
 /** Test-only: admission-boundary counters (proves the new paths fire). */
 export function responseAdmissionCountersForTests(): Readonly<typeof admissionCounters> {
@@ -124,6 +128,7 @@ function measureResidentEntry(id: string, entry: ResidentInput): ResidentRespons
   const sizeBytes = serializedBytes({
     responseId: id,
     createdAt: entry.createdAt,
+    ...(entry.clientThreadId ? { clientThreadId: entry.clientThreadId } : {}),
     items: entry.items,
     ...(entry.providers ? { providers: entry.providers } : {}),
   });
@@ -224,6 +229,7 @@ function swapResidentForSpill(id: string, expected: ResidentResponseState, ref:
   const base: Omit<SpilledResponseState, "sizeBytes"> = {
     kind: "spill",
     createdAt: expected.createdAt,
+    ...(expected.clientThreadId ? { clientThreadId: expected.clientThreadId } : {}),
     ...(expected.providers ? { providers: expected.providers } : {}),
     spill: ref,
   };
@@ -244,12 +250,14 @@ function replaceSpillEntryAtomically(
   try {
     const ref = writeResponseSpillDurably(id, {
       createdAt: candidate.createdAt,
+      ...(candidate.clientThreadId ? { clientThreadId: candidate.clientThreadId } : {}),
       items: candidate.items,
       ...(candidate.providers ? { providers: candidate.providers } : {}),
     });
     const base: Omit<SpilledResponseState, "sizeBytes"> = {
       kind: "spill",
       createdAt: candidate.createdAt,
+      ...(candidate.clientThreadId ? { clientThreadId: candidate.clientThreadId } : {}),
       ...(candidate.providers ? { providers: candidate.providers } : {}),
       spill: ref,
     };
@@ -322,6 +330,7 @@ function admitOversizedCandidate(
   try {
     const ref = writeResponseSpillDurably(id, {
       createdAt: candidate.createdAt,
+      ...(candidate.clientThreadId ? { clientThreadId: candidate.clientThreadId } : {}),
       items: candidate.items,
       ...(candidate.providers ? { providers: candidate.providers } : {}),
     });
@@ -337,6 +346,7 @@ function admitOversizedCandidate(
     const base: Omit<SpilledResponseState, "sizeBytes"> = {
       kind: "spill",
       createdAt: candidate.createdAt,
+      ...(candidate.clientThreadId ? { clientThreadId: candidate.clientThreadId } : {}),
       ...(candidate.providers ? { providers: candidate.providers } : {}),
       spill: ref,
     };
@@ -385,6 +395,7 @@ function snapshotPath(): string {
 
 interface LegacySnapshotState {
   createdAt?: unknown;
+  clientThreadId?: unknown;
   items?: unknown;
   providers?: OcxProviderContinuationState;
   conversationId?: unknown;
@@ -405,11 +416,15 @@ function loadSnapshotEntry(id: string, value: unknown): void {
   if (!value || typeof value !== "object" || Array.isArray(value)) return;
   const rec = value as LegacySnapshotState & { kind?: unknown; spill?: unknown };
   if (typeof rec.createdAt !== "number" || !Number.isFinite(rec.createdAt)) return;
+  const clientThreadId = typeof rec.clientThreadId === "string" && rec.clientThreadId.trim().length > 0
+    ? rec.clientThreadId.trim()
+    : undefined;
   if (rec.kind === "spill") {
     if (!isSpillRef(rec.spill)) return;
     const base: Omit<SpilledResponseState, "sizeBytes"> = {
       kind: "spill",
       createdAt: rec.createdAt,
+      ...(clientThreadId ? { clientThreadId } : {}),
       ...(rec.providers ? { providers: rec.providers } : {}),
       spill: rec.spill,
     };
@@ -434,6 +449,7 @@ function loadSnapshotEntry(id: string, value: unknown): void {
     : undefined);
   const resident = measureResidentEntry(id, {
     createdAt: rec.createdAt,
+    ...(clientThreadId ? { clientThreadId } : {}),
     items: rec.items,
     ...(providers ? { providers } : {}),
   });
@@ -747,6 +763,7 @@ function pruneResponses(at = now()): void {
     try {
       const ref = writeResponseSpillDurably(oldestId, {
         createdAt: entry.createdAt,
+        ...(entry.clientThreadId ? { clientThreadId: entry.clientThreadId } : {}),
         items: entry.items,
         ...(entry.providers ? { providers: entry.providers } : {}),
       });
@@ -788,6 +805,7 @@ export function evictOldestResponseContinuationForBudget(): number {
   try {
     const ref = writeResponseSpillDurably(id, {
       createdAt: entry.createdAt,
+      ...(entry.clientThreadId ? { clientThreadId: entry.clientThreadId } : {}),
       items: entry.items,
       ...(entry.providers ? { providers: entry.providers } : {}),
     });
@@ -828,6 +846,7 @@ function materializeEntry(
   }
   const state = measureResidentEntry(id, {
     createdAt: result.payload.createdAt,
+    ...(result.payload.clientThreadId ? { clientThreadId: result.payload.clientThreadId } : {}),
     items: result.payload.items,
     ...(result.payload.providers ? { providers: result.payload.providers } : {}),
   });
@@ -840,7 +859,16 @@ function materializeEntry(
   return { ok: true, state };
 }
 
-export function expandPreviousResponseInput(body: unknown): unknown {
+function normalizedClientThreadId(value: unknown): string | undefined {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+
+function withoutPreviousResponseId(request: Record<string, unknown>): Record<string, unknown> {
+  const { previous_response_id: _previousResponseId, ...freshRequest } = request;
+  return freshRequest;
+}
+
+export function expandPreviousResponseInput(body: unknown, clientThreadId?: string): unknown {
   if (!body || typeof body !== "object" || Array.isArray(body)) return body;
   const request = body as Record<string, unknown>;
   const previousId = typeof request.previous_response_id === "string" ? request.previous_response_id : undefined;
@@ -854,6 +882,16 @@ export function expandPreviousResponseInput(body: unknown): unknown {
     replayFailures.set(request, materialized.failure);
     return body;
   }
+  const requestThreadId = normalizedClientThreadId(clientThreadId);
+  const storedThreadId = normalizedClientThreadId(materialized.state.clientThreadId);
+  // A Codex task must never inherit another task's continuation, nor a legacy unscoped entry.
+  // Unscoped callers retain backward-compatible replay only with other unscoped entries.
+  if (requestThreadId !== storedThreadId) {
+    const freshRequest = withoutPreviousResponseId(request);
+    replayScopeMismatches.add(freshRequest);
+    replayScopeMismatchDrops += 1;
+    return freshRequest;
+  }
   const expanded = {
     ...request,
     input: [...materialized.state.items, ...inputItems(request.input)],
@@ -873,6 +911,11 @@ export function previousResponseReplayPrefixLength(body: unknown): number {
   return replayedInputPrefixLengths.get(body) ?? 0;
 }
 
+/** True when a stale or foreign previous_response_id was removed from this exact request body. */
+export function previousResponseScopeMismatch(body: unknown): boolean {
+  return !!body && typeof body === "object" && replayScopeMismatches.has(body as object);
+}
+
 export function previousResponseConversationId(responseId: string | undefined): string | undefined {
   return previousResponseProviderState(responseId)?.cursor?.conversationId;
 }
@@ -898,6 +941,7 @@ export interface ResponseStateMetrics {
   spillWrites: number;
   spillWriteFailures: number;
   spillReadFailures: number;
+  replayScopeMismatchDrops: number;
 }
 
 /**
@@ -940,6 +984,7 @@ export function responseStateMetrics(): ResponseStateMetrics {
     spillWrites: spillCounters.writes,
     spillWriteFailures: spillCounters.writeFailures,
     spillReadFailures: spillCounters.readFailures,
+    replayScopeMismatchDrops,
   };
 }
 
@@ -972,7 +1017,7 @@ export function rememberResponseState(
   requestBody: unknown,
   response: { id?: unknown; output?: unknown; status?: unknown; incomplete_details?: unknown },
   providerState?: OcxProviderContinuationState | string,
-  opts?: { force?: boolean },
+  opts?: { force?: boolean; clientThreadId?: string },
 ): void {
   if (!requestBody || typeof requestBody !== "object" || Array.isArray(requestBody)) return;
   const request = requestBody as Record<string, unknown>;
@@ -998,8 +1043,10 @@ export function rememberResponseState(
       return !!item && typeof item === "object" && (item as { type?: unknown }).type === "function_call";
     });
   }
+  const clientThreadId = normalizedClientThreadId(opts?.clientThreadId);
   setResidentEntry(response.id, {
     createdAt: now(),
+    ...(clientThreadId ? { clientThreadId } : {}),
     items: [...inputItems(request.input), ...response.output],
     // Always preserve the Cursor conversation id so the next tool-result turn can continue the SAME
     // Cursor conversation (multi-turn continuation). Separately track whether Cursor's own
@@ -1045,6 +1092,7 @@ export function clearResponseStateMemoryForTests(): void {
   spillCounters.writes = 0;
   spillCounters.writeFailures = 0;
   spillCounters.readFailures = 0;
+  replayScopeMismatchDrops = 0;
   persistAttemptHookForTests = null;
   loaded = false;
 }

package/src/server/index.ts

@@ -53,6 +53,7 @@ import { loadLabAutomationPolicy } from "../lab/automation/persistence";
 import { createProductionLabRouteExecutor } from "../lib/lab-live-route-production";
 import { runOpenAiTierStartupMigration } from "../providers/openai-tier-startup";
 import { runAlibabaRegionStartupMigration } from "../providers/alibaba-region-startup";
+import { runModelRenameStartupMigration } from "../providers/model-rename-startup";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { providerContextCap } from "../providers/context-cap";
 import { providerCodexAccountMode } from "../providers/registry";
@@ -490,7 +491,7 @@ export function warnAgentTaskRecoveryStartup(config: {
 
 export function startServer(port?: number, deps: StartServerDeps = {}): Server<WsData> {
   const localAttestationSecret = deps.localAttestationSecret ?? createLocalAttestationSecret();
-  const config = runAlibabaRegionStartupMigration(runOpenAiTierStartupMigration(loadConfig()));
+  const config = runModelRenameStartupMigration(runAlibabaRegionStartupMigration(runOpenAiTierStartupMigration(loadConfig())));
   warnAgentTaskRecoveryStartup(config);
   setLiveStateStoreConfig(config);
   applyProxyEnv(config);